-

CVE-2023-53246

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL

When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount
is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to
S_AUTOMOUNT and corresponding dentry flags is retained regardless of
CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in
VFS follow_automount() when traversing a DFS referral link:
  BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  Call Trace:
   <TASK>
   __traverse_mounts+0xb5/0x220
   ? cifs_revalidate_mapping+0x65/0xc0 [cifs]
   step_into+0x195/0x610
   ? lookup_fast+0xe2/0xf0
   path_lookupat+0x64/0x140
   filename_lookup+0xc2/0x140
   ? __create_object+0x299/0x380
   ? kmem_cache_alloc+0x119/0x220
   ? user_path_at_empty+0x31/0x50
   user_path_at_empty+0x31/0x50
   __x64_sys_chdir+0x2a/0xd0
   ? exit_to_user_mode_prepare+0xca/0x100
   do_syscall_64+0x42/0x90
   entry_SYSCALL_64_after_hwframe+0x72/0xdc

This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler
when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to
avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This
approach was chosen as it provides more control over the error path.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorLinux
Product Linux
Default Statusunaffected
Version < 8cd7dbc9c46d51e00a0a8372e07cc1cbb8d24a77
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Status affected
Version < 8afb1fabcec1929db46977e84baeee0cc0e79242
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Status affected
Version < 657d7c215ca974d366ab1808213f716e1e3aa950
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Status affected
Version < 26a32a212bc540f4773cd6af8cf73e967d72569c
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Status affected
Version < b64305185b76f1d5145ce594ff48f3f0e70695bd
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Status affected
Version < b7d854c33ab48e55fc233699bbefe39ec9bb5c05
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Status affected
Version < 1e144b68208e98fd4602c842a7149ba5f41d87fb
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Status affected
Version < 179a88a8558bbf42991d361595281f3e45d7edfc
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Status affected
VendorLinux
Product Linux
Default Statusaffected
Version <= 4.14.*
Version 4.14.312
Status unaffected
Version <= 4.19.*
Version 4.19.280
Status unaffected
Version <= 5.4.*
Version 5.4.240
Status unaffected
Version <= 5.10.*
Version 5.10.177
Status unaffected
Version <= 5.15.*
Version 5.15.106
Status unaffected
Version <= 6.1.*
Version 6.1.23
Status unaffected
Version <= 6.2.*
Version 6.2.10
Status unaffected
Version <= *
Version 6.3
Status unaffected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.078
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string